fix: suppress verbose PHP errors and bound login/audit housekeeping cost

- bootstrap.php: disable display_errors/display_startup_errors in favour of
  PHP's own error log, so an uncaught engine error can never leak a stack
  trace or filesystem path to a client.
- LoginRateLimiter: cap tracked address/identity buckets at 20000, evicting
  the least recently active first, so a distributed flood of distinct
  addresses or login names cannot grow login-attempts.json without bound.
- Logger: prune expired audit logs probabilistically (1-in-100) instead of
  on every request, since every request already builds a Logger and a full
  directory scan on each one scales with total rotated log files.

Found during a self-review security audit; full findings available on
request.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cms/bootstrap.php

@@ -1,6 +1,12 @@
 <?php
 /** Shared entry-point setup: loads configuration into $config and registers the NeoCMS class autoloader. */
 
+// Keep stack traces and filesystem paths out of responses; every engine warning still reaches PHP's own error log.
+error_reporting(E_ALL);
+ini_set('display_errors', '0');
+ini_set('display_startup_errors', '0');
+ini_set('log_errors', '1');
+
 require_once __DIR__ . '/config.php';
 
 // URL prefix of the site root: "/neocms" for http://localhost/neocms/, "" for a site at the domain root.